Switching domain from HTTPS to HTTP

Question

I recently launched a new site on an existing domain, using new hosting. The previous site utilized HTTPS, the new site does not (just HTTP).

The problem I ran into is that Google currently has the site indexed as HTTPS. The site is in WordPress, I've tried to 301 redirect HTTPS URLs to HTTP with .htaccess (placing rules above the WordPress rules), with no success. The HTTPS version displays the security warning of course (as there is no SSL certificate) and then a 404 if you go past that.

Here is what the .htaccess file currently looks like:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} ^443$
RewriteRule ^(.*)$ http://%{HTTP_HOST}/$1 [R=301,L]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

I've tried other rules as well to redirect the traffic with no luck.

Additionally, Google Chrome still redirects example.com to https://example.com, no amount of clearing cache resolves this issue. All other browsers work fine, www.example.com works as expected in all browsers.

Has anyone else experienced these issues when moving a domain away from HTTPS? Is there a standard way to notify Google of the change?

Answer 1

Why not get a free SSL certificate from Lets Encrypt, then your https will work. Ride the horse in the direction it is going...

Answer 2

(Just a guess.)

If the old site used HSTS, you have to wait the number of seconds that were specified in max-age until users that visited the HTTPS version can visit the HTTP version again.

(If HTTPS would still work, you could send the HSTS header and specify a very short max-age, and after most users visited again, stop sending the header, and then transition to HTTP.)

You could remove the domain from your browser’s HSTS Policy cache, but this would of course only help you, not your visitors (unless they do the same). In Chrome/Chromium, you should be able to access the cache under the address chrome://net-internals/#hsts; there you can delete your domain.¹

¹ I guess this doesn’t work if your domain is included in the preload list.

Answer 3

The HTTPS version displays the security warning of course (as there is no SSL certificate) and then a 404 if you go past that.

If you get a "security warning" that you are able to bypass then the server is listening on port 443 and there is a security certificate installed but for a different domain/hostname.

When you bypass this invalid certificate then the request is probably not reaching your website (Virtual Host) in a shared hosting environment, hence the 404.

There is no way for you to redirect the HTTPS request as it's not reaching your site.

The only way to resolve this is to install a valid SSL cert for your site.

Additionally, Google Chrome still redirects example.com to https://example.com, no amount of clearing cache resolves this issue. All other browsers work fine, www.example.com works as expected in all browsers.

You should examine the network traffic in the Browser's object inspector - this should tell you exactly what mechanism (cache, HSTS, ?) is triggering the redirect - whether it even is a redirect (in the case of HSTS).